Tapioca DAO — AaveStrategy setMultiSwapper bricks compound

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 27529-h-39-aavestrategysol-changing-swapper-breaks-the-contract-co. Standalone Foundry PoC and full write-up: 27529-h-39-aavestrategysol-changing-swapper-breaks-the-contract-co_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/wrong-condition · vuln/access-roles · vuln/permanent

Reproduction: self-contained Foundry PoC with only forge-std — no fork, no RPC. Full trace: output.txt. PoC: test/27529-h-39-aavestrategysol-changing-swapper-breaks-the-contract-co.sol.

Key info#


Impact	HIGH — after swapper upgrade, `compound()` reverts; rewards stuck and withdraw paths that compound first break
Protocol	Tapioca DAO
Vulnerable code	`AaveStrategy.setMultiSwapper` — updates pointer without approve
Bug class	Incomplete admin setter / missing allowance transfer
Finding	Code4rena — Tapioca, 2023-07 · #27529 · reporter carrotsmuggler
Report	code4rena.com/reports/2023-07-tapioca
Source	AuditVault
Status	Confirmed by Tapioca (dup #222)
Compiler	`^0.8.24` (PoC)

TL;DR#

Constructor approves the initial multiSwapper for rewardToken.
setMultiSwapper only stores the new address.
New swapper has zero allowance → compound transferFrom fails → withdrawals that compound first brick.

The vulnerable code#

SOLIDITY

function setMultiSwapper(address _swapper) external onlyOwner {
    emit MultiSwapper(address(swapper), _swapper);
    // @> VULN: no approve / revoke
    swapper = ISwapper(_swapper);
}

Fix: revoke old allowance, assign, approve new (as in ConvexTricryptoStrategy).

Root cause#

Allowance is treated as constructor-only setup, but the swapper is mutable.

Attack walkthrough#

Strategy holds 100 AAVE rewards; initial swapper is approved.
Owner upgrades multiSwapper (routine ops).
Anyone calling compound reverts; rewards remain unswapped; WETH balance stays 0.

Diagrams#

flowchart LR A[Constructor approve old swapper] --> B[setMultiSwapper new] B --> C[New swapper allowance = 0] C --> D[compound transferFrom reverts] D --> E[Rewards stuck / withdraw path bricked]

Impact#

Broken compounding and withdraw liveness after any legitimate swapper upgrade — permanent fund impairment until emergency re-approve.

Taxonomy#

genome: wrong-condition, permanent, access-roles, fot-slippage, liquidation-underwater, oracle-freshness
sector: dex, governance, lending, token, vault
severity: high
platform: code4rena

Sources#

AuditVault finding #27529
Code4rena report 2023-07-tapioca
Reduced from Tapioca AaveStrategy.sol setMultiSwapper (2023-07 contest)

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 27529-h-39-aavestrategysol-changing-swapper-breaks-the-contract-co_exp (evm-hack-registry mirror).
AuditVault finding: 27529-h-39-aavestrategysol-changing-swapper-breaks-the-contract-co.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync